IT Systems & Security Operations Specialist

Change Craft; Philippines; On-site; PHP 600,000 - 900,000; Full time

Job summary

Change Craft seeks an IT Systems & Security Operations Specialist to own and manage the company’s technology environment, leading day-to-day security operations across cloud, email, identity, endpoints and websites.

The ideal candidate will think strategically about systems security, detect and contain threats, and support data protection and client projects with robust governance and tooling.

Qualifications

• Bachelor's degree in a relevant field.
• 5+ years managing SaaS/cloud tools with security emphasis.
• Strong knowledge of Google Workspace and Microsoft 365 security.
• Experience with SIEM/EDR/XDR and incident response.

Responsibilities

• Own security operations across cloud, email, identity, endpoint and web.
• Monitor alerts from security tools and triage incidents promptly.
• Lead containment, eradication, and recovery during incidents.
• Develop incident response playbooks and tabletop exercises.
• Maintain data protection, access controls, and threat intelligence.

Skills

Strategic thinker

Threat detection & incident response

Documentation & reporting

Collaboration across teams

Education

Bachelor's degree in Information Systems / Computer Science / IT / Cybersecurity

Tools

Google Workspace

Microsoft 365 Defender

Entra ID / Azure AD

SIEM / EDR/XDR

SPF/DKIM/DMARC knowledge

GRC tools

Job description

Change Craft is a Sacramento-based strategic communications and marketing agency serving clients in public health, government, education, and social impact sectors. Our work involves complex projects, multiple interconnected systems, and strict data security requirements. We are seeking an IT Systems & Security Operations Specialist to own and manage the company's technology environment, including systems, applications, equipment, and websites, and to lead day‑to‑day security operations.

This is not a basic help desk role. The ideal candidate thinks strategically about systems, security and operational efficiency, and can detect, investigate, and contain threats before they affect our clients. The role also includes data entry and data collection support for active client projects as needed.

Systems Administration

• Manage accounts, access, and configurations across company platforms, including Google Workspace, Microsoft 365 and Teams, Apple, Asana, Slack, Zoom, Adobe, Gusto, Stripe, Squarespace, GoDaddy, Mailchimp, Whova, IBM SPSS, Google Drive, and other cloud storage and tools used by the agency
• Create and manage user accounts, access permissions, and roles
• Maintain system configurations and secure baseline settings for each platform
• Monitor system updates and new features

Identity & Access Management

• Implement and maintain secure authentication protocols, including Single Sign-On (SSO) where applicable
• Enforce multi-factor authentication (MFA) across all systems, prioritizing phishing‑resistant methods for administrator accounts
• Manage role‑based access using least‑privilege principles, and monitor privileged and administrator accounts
• Conduct periodic access audits and promptly remove unused or excess access
• Enforce company password management policies and tools

Security Operations & Threat Detection

• Serve as the company's primary security operations function, monitoring for and responding to threats across cloud, email, identity, endpoint, and web environments
• Monitor and triage security alerts from Google Workspace, Microsoft 365 and Defender, endpoint protection (EDR/XDR), and other security tools
• Analyze logs and activity for indicators of compromise, such as suspicious logins, impossible travel, unusual data downloads or sharing, mailbox rule changes, and unauthorized OAuth app grants
• Configure, tune, and maintain detection rules and alerting to improve accuracy and reduce false positives
• Conduct proactive threat hunting informed by current threat intelligence relevant to our sector and technology stack
• Investigate suspected phishing, business email compromise, malware, and account takeover attempts
• Maintain email security controls, including spam and phishing filtering and SPF, DKIM, and DMARC records
• Monitor threat intelligence sources and vendor advisories for vulnerabilities affecting company systems
• Escalate confirmed or high‑severity threats to leadership with clear, timely summaries
• If the company engages a managed detection and response (MDR) or managed SOC provider, serve as the internal owner of that relationship, including escalations, tuning, and service reviews

Incident Response

• Develop, maintain, and test the company's incident response plan and playbooks, such as phishing, account compromise, ransomware, lost or stolen device, and data exposure
• Lead containment, eradication, and recovery during security incidents
• Preserve logs and evidence to support investigations and any required reportingDocument incidents, timelines, root causes, and corrective actions
• Provide leadership with the facts needed for client, contractual, legal, or regulatory notification decisions
• Facilitate periodic tabletop exercises with relevant staff

Vulnerability & Patch Management

• Maintain an inventory of systems, devices, and applications to define the company's security footprint
• Run regular vulnerability scans and review SaaS security configurations for misconfigurations
• Track, prioritize, and verify remediation of vulnerabilities based on risk
• Ensure operating systems, applications, browsers, and website components are patched on schedule
• Monitor endpoint compliance, including encryption, screen lock, OS version, and security software status

Data Protection & Privacy

• Develop and maintain a data classification framework covering public, internal, confidential, and restricted client data
• Implement and manage data loss prevention (DLP) controls in Google Workspace and Microsoft 365
• Monitor and restrict external file sharing, public links, and access to sensitive folders
• Ensure encryption of data in transit and at rest, including full‑disk encryption on company devices
• Maintain data retention and secure deletion practices aligned with client contracts and company policy
• Support compliance with client data security requirements, including security questionnaires, contract terms, and data handling agreements
• Assess the security and privacy practices of new tools and vendors before adoption
• Maintain data protection standards for sensitive client and company information, including personally identifiable information and research data

Security Awareness & Reporting

• Deliver security awareness training during onboarding and on a recurring basis
• Run periodic phishing simulations and provide targeted follow‑up training
• Serve as the go‑to resource for staff questions about suspicious emails, messages, or activity
• Provide leadership with regular security reports covering alerts, incidents, vulnerabilities, access reviews, and training completion
• Recommend security improvements and investments based on risk, aligned with a recognized framework such as the NIST Cybersecurity Framework or CIS Controls

Backup & Disaster Recovery

• Maintain data backup protocols, including protection against ransomware and accidental deletion
• Ensure company data is backed up and recoverable, and periodically test restoration procedures
• Maintain documentation of disaster recovery plans

Equipment & Device Management

• Maintain an inventory of all company technology equipment, including device updates and warranties
• Manage devices through mobile device management (MDM) tools, including remote lock and wipe
• Order equipment for new employees and manage onboarding and offboarding technology setup, including same‑day access removal at offboarding
• Support remote employees with device troubleshooting

Technical Support

• Provide troubleshooting support for employees experiencing technical issues
• Assist staff with system setup and best practices
• Maintain documentation and guides for internal systems

Vendor & License Management

• Track software licenses and seat utilization
• Manage renewals and vendor relationships
• Monitor software costs, identify opportunities to reduce expenses, and negotiate pricing when appropriate

Workflow Optimization & Automation

• Identify opportunities to improve workflows across systems
• Recommend and implement integrations or automation tools where appropriate, including security alert and access workflows
• Maintain an efficient system architecture as the company grows

Data & Research Support

• Assist with survey administration and online data collection for internal research and analytics projects
• Organize incoming data and ensure it is stored and shared securely
• Perform data entry and data cleaning when needed
• Support research teams with tools such as SPSS and survey platforms

File & Digital Systems Organization

• Maintain a clear, structured company file system with files that are organized, accessible, and properly labeled
• Manage access permissions across shared drives
• Periodically review and improve file structures

Documentation & Training

• Maintain documentation of all company systems, security policies, and workflows
• Stay informed about new tools, threats, and best practices
• Conduct occasional internal trainings to help staff use systems effectively and securely

Website Management (Squarespace)

• Maintain and update the company website using the Squarespace CMS, including pages, blog posts, team updates, and announcements
• Implement basic site configuration and layout adjustments, and coordinate updates to images, copy, and page structure based on internal requests
• Ensure website functionality, forms, and integrations remain operational, and monitor site performance for improvement opportunities
• Maintain organized backups of website content and assets
• Secure website and domain accounts (Squarespace, GoDaddy) with MFA, domain lock, and DNS monitoring
• Perform routine maintenance and updates to keep the website secure and current

Required Qualifications

• Bachelor's degree in Information Systems, Computer Science, IT, Cybersecurity, or a related field
• 5+ years of experience managing SaaS systems and cloud tools, including at least 2 years in security operations, SOC, or incident response
• Strong experience with Google Workspace administration and its security controls
• Hands‑on experience with Microsoft 365 security tools, such as Microsoft Defender and Entra ID
• Hands‑on experience with SIEM, EDR/XDR, or similar security monitoring toolsExperience triaging alerts, analyzing logs, and investigating phishing and account compromise
• Experience managing multiple SaaS platforms in a business environment, including user access management, permissions, and MFA enforcement
• Working knowledge of data protection practices, including DLP, encryption, and secure file sharing
• Strong understanding of cybersecurity best practices and frameworks such as the NIST Cybersecurity Framework or CIS Controls
• Excellent troubleshooting and problem‑solving skills

What Success Looks Like

• Company systems, devices, and websites that are secure, current, and consistently available to staff
• Threats detected, investigated, and contained quickly, with clear communication to leadership
• Sensitive client and company data that is well protected and handled in line with contractual and policy requirements
• Staff who are confident using company tools securely and know where to turn with questions